Summary
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to bypass same origin restrictions, obtain
sensitive information, spoof the addressbar, spoof the print dialog,
cause a denial of service via application crash or hang, or execute
arbitrary code. (CVE-2017-5398, CVE-2017-5399, CVE-2017-5400,
CVE-2017-5401, CVE-2017-5402, CVE-2017-5403, CVE-2017-5404, CVE-2017-5405,
CVE-2017-5406, CVE-2017-5407, CVE-2017-5408, CVE-2017-5410, CVE-2017-5412,
CVE-2017-5413, CVE-2017-5414, CVE-2017-5415, CVE-2017-5416, CVE-2017-5417,
CVE-2017-5418, CVE-2017-5419, CVE-2017-5420, CVE-2017-5421, CVE-2017-5422,
CVE-2017-5426, CVE-2017-5427)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | firefox | 52.0+build2-0ubuntu0.14.04.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | firefox | 52.0+build2-0ubuntu0.16.04.1 |
Vulnerabilities 25
-
Unscored —
Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we pr…
-
Unscored —
Memory safety bugs were reported in Firefox 51. Some of these bugs showed evidence of memory corruption and we presume …
-
Unscored —
JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potent…
-
Unscored —
A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error. The res…
-
Unscored —
A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroy…
-
Unscored —
When adding a range to an object in the DOM, it is possible to use "addRange" to add the range to an incorrect root obj…
-
Unscored —
A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree an…
-
Unscored —
Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. Th…
-
Unscored —
A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip …
-
Unscored —
Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract p…
-
Unscored —
Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-…
-
Unscored —
Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in ho…
-
Unscored —
A buffer overflow read during SVG filter color value operations, resulting in data exposure. This vulnerability affects…
-
Unscored —
A segmentation fault can occur during some bidirectional layout operations. This vulnerability affects Firefox < 52 and…
-
Unscored —
The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating sy…
-
Unscored —
An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leadi…
-
Unscored —
In certain circumstances a networking event listener can be prematurely released. This appears to result in a null dere…
-
Unscored —
When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the…
-
Unscored —
An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leak…
-
Unscored —
If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-respon…
-
Unscored —
A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressb…
-
Unscored —
A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user c…
-
Unscored —
If a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it can trigger a non-exploi…
-
Unscored —
On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is start…
-
Unscored —
A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. I…
References
-
report
https://ubuntu.com/security/CVE-2017-5398
-
report
https://ubuntu.com/security/CVE-2017-5399
-
report
https://ubuntu.com/security/CVE-2017-5400
-
report
https://ubuntu.com/security/CVE-2017-5401
-
report
https://ubuntu.com/security/CVE-2017-5402
-
report
https://ubuntu.com/security/CVE-2017-5403
-
report
https://ubuntu.com/security/CVE-2017-5404
-
report
https://ubuntu.com/security/CVE-2017-5405
-
report
https://ubuntu.com/security/CVE-2017-5406
-
report
https://ubuntu.com/security/CVE-2017-5407
-
report
https://ubuntu.com/security/CVE-2017-5408
-
report
https://ubuntu.com/security/CVE-2017-5410
-
report
https://ubuntu.com/security/CVE-2017-5412
-
report
https://ubuntu.com/security/CVE-2017-5413
-
report
https://ubuntu.com/security/CVE-2017-5414
-
report
https://ubuntu.com/security/CVE-2017-5415
-
report
https://ubuntu.com/security/CVE-2017-5416
-
report
https://ubuntu.com/security/CVE-2017-5417
-
report
https://ubuntu.com/security/CVE-2017-5418
-
report
https://ubuntu.com/security/CVE-2017-5419
-
report
https://ubuntu.com/security/CVE-2017-5420
-
report
https://ubuntu.com/security/CVE-2017-5421
-
report
https://ubuntu.com/security/CVE-2017-5422
-
report
https://ubuntu.com/security/CVE-2017-5426
-
report
https://ubuntu.com/security/CVE-2017-5427